Does the EU AI Act apply in Switzerland?

What Switzerland decided, and did not

On 12 February 2025 the Federal Council set the Swiss course: no Swiss counterpart to the EU's comprehensive AI Act, accession to the Council of Europe Framework Convention on AI (CETS No. 225), which Switzerland signed on 27 March 2025 and which the Federal Council intends to ratify, ratification requiring parliamentary approval, and legislative adjustments that are to be sector-specific wherever possible, with general, cross-sector rules confined to central fundamental-rights areas such as data protection, and non-binding measures such as self-declaration agreements or industry solutions alongside; a consultation draft covering transparency, data protection, non-discrimination and oversight is due by the end of 2026.

The mandate sits with the Federal Department of Justice and Police (FDJP), working with DETEC, within which OFCOM (BAKOM) carries the technical file, and the Federal Department of Foreign Affairs (FDFA). The stated objectives are innovation, fundamental-rights protection including economic freedom, and public trust. The method mirrors what Switzerland did with crypto: classify into existing law, adjust where needed, avoid a code. For companies this means the Swiss rulebook will arrive largely in pieces and by sector, with a cross-sector core in the fundamental-rights areas, and the consultation draft due by the end of 2026 is the piece to watch through 2027.

Where the EU Act reaches into Switzerland

The scope rules of Regulation (EU) 2024/1689 turn on where AI is supplied and where its output is used, and a Swiss establishment does not take a company outside them; the Commission's GPAI questions and answers state the point for third-country providers of general-purpose models. Four triggers matter in practice. The first two are scope tests under Article 2(1) of the Act; the third and fourth are practical and contractual routes by which the Act's standards reach a company that is outside its direct scope.

Placing on the EU market: a Swiss company that places AI systems or general-purpose models on the EU market, or puts an AI system into service there, including for its own EU use, is within the Act. Which duties follow depends on its role, provider under Article 3(3) or, where it only makes another's system available, distributor, and on what it supplies: the high-risk requirements for a high-risk system, the transparency obligations we covered in our Article 50 update where the system generates content or interacts with people, or the model obligations of Chapter V for a general-purpose model. The third-country machinery is likewise specific: an EU authorised representative is required of third-country providers of high-risk systems (Article 22, on the high-risk timetable) and of general-purpose models (Article 54, applicable since 2 August 2025, with an exemption for open-source models that do not present systemic risk); there is no general representative requirement for every Swiss supplier of AI.

Output used in the EU: the trigger most easily overlooked. A model can run entirely on Zurich infrastructure; if the system's output is used in the EU, scores delivered to EU customers, content produced for EU audiences, decisions affecting EU users, the Act applies to the Swiss provider or deployer under Article 2(1)(c). Serving EU clients from Switzerland therefore has to be tested system by system: the trigger is the use of the system's output in the Union, and having an EU client does not settle it either way.

Group structure: EU subsidiaries deploying group AI tools carry deployer duties locally, which in practice pulls group AI governance up to the EU standard, the same dynamic we described for AML and DORA. Value-chain position: a Swiss supplier of models or AI components to EU providers meets the Act through its customers' obligations and contracts, whether or not it is within scope itself. A company with none of these connections, Swiss AI, Swiss clients, Swiss output, stands outside the EU regulation; one whose only connection is a group entity or a value-chain position is outside its direct scope, though the Act's standards will still reach it through those routes.

Scope is one question and timing another. As at the date of this update the prohibitions and the general-purpose model obligations apply (a model placed on the market before 2 August 2025 has until 2 August 2027), Article 50 has applied since 2 August 2026, with the marking duty under Article 50(2) deferred to 2 December 2026 for systems already on the market, and the high-risk requirements, with the deployer duties that go with them, apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems under Regulation (EU) 2026/1744.

The Swiss layer that applies anyway

Swiss law applies whether or not the EU Act does. Three Swiss sources do the work today. The FADP governs every AI use touching personal data: transparency toward data subjects, automated-decision provisions, data security and the transfer analysis for foreign-hosted tools, the same architecture question we examined for Chinese models. For supervised financial institutions, FINMA has made its position explicit: Guidance 08/2024 expects institutions using AI to assess the impact on their risk profile and align governance, risk management and controls accordingly, naming model risk, data quality, third-party dependence and explainability, and FINMA's AI dossier tracks the developing supervisory practice. And general law, contract, liability, unfair competition, employment, discrimination, applies to AI-driven conduct exactly as it applies to any other conduct, which the convention implementation will sharpen once enacted. The consultation draft due by the end of 2026 is the first of several stages, consultation, dispatch, Parliament and the referendum period, before any new statute binds; positions taken now, in policies and contracts, should be written with it in mind.

One governance framework for both regimes

For most Swiss companies with any EU nexus, the practical conclusion is that you will comply with the EU standard for a substantial part of your AI estate, because the triggers catch your EU-facing business, your group entities or your customers' expectations, and running two AI governance regimes side by side costs more than running one. The defensible approach is a single framework, inventory, risk classification, human oversight, transparency, documentation, mapped to the EU Act where it applies and presented under the FADP, FINMA and, in time, the convention-implementation where it does not. The Swiss advantage lies in sequencing and proportionality: no high-risk conformity machinery for purely domestic uses, lighter documentation where no trigger fires, and the freedom to adopt EU-grade controls selectively. Mapping the triggers now is what preserves that choice; left unmapped, the EU standard tends to arrive anyway, through the largest customer's next contract renewal.

What this means for you

• Map the four triggers against your AI inventory. Market placement, EU-used output, group entities, value-chain position: each system gets a yes or no, in writing. The output trigger needs the most care, because serving EU clients from Zurich can bring the Act to you where your system's output is used in the EU; test it per system, then structure or scope the service deliberately.
• Supervised firms: answer FINMA 08/2024 now. Governance, risk-profile assessment and controls for AI use are already expected.
• Build a single framework. EU-grade governance applied proportionately is easier to defend than parallel regimes or improvisation.
• Watch the end-2026 consultation draft. The draft rules on transparency, data protection, non-discrimination and oversight are being written in 2026 and will still pass through consultation and Parliament; it is the moment to align policies once.

Isak Legal advises Swiss and international companies on AI governance across the EU and Swiss regimes, trigger analysis, deployment policies and vendor contracts. See our AI, Data & Technology and Switzerland as a base pages, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The Swiss implementation of the Council of Europe convention is in preparation and the EU guidance continues to develop; verify the current position at the official sources linked above before acting. For advice on a specific matter, please contact us.